<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.840670,1.703130,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="46.147.76.104" dst_port="445"/>
            <filter src_ip="46.147.76.104" dst_port="139"/>
        </slice>
        <from usec="0" sec="1275800895"/>
        <to usec="0" sec="1275800943"/>
    </anomaly>
    <anomaly type="anomalous" value="1.799070,1.704200,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.150.16.184" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275800423"/>
        <to usec="0" sec="1275801220"/>
    </anomaly>
    <anomaly type="anomalous" value="1.799070,1.704200,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="73.55.67.176" dst_port="139"/>
        </slice>
        <from usec="0" sec="1275800627"/>
        <to usec="0" sec="1275800658"/>
    </anomaly>
    <anomaly type="anomalous" value="1.799070,1.704200,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="2.35.188.74" dst_port="139"/>
            <filter src_ip="2.35.188.74" dst_port="445"/>
        </slice>
        <from usec="0" sec="1275801131"/>
        <to usec="0" sec="1275801211"/>
    </anomaly>
    <anomaly type="anomalous" value="3.053660,2.637810,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.48.134.215" dst_port="22"/>
        </slice>
        <from usec="0" sec="1275801218"/>
        <to usec="0" sec="1275801220"/>
    </anomaly>
    <anomaly type="anomalous" value="1.840670,1.703130,010,1 1 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="0.250.149.224" dst_port="23"/>
        </slice>
        <from usec="0" sec="1275800423"/>
        <to usec="0" sec="1275800896"/>
    </anomaly>
    <anomaly type="anomalous" value="1.982320,1.737090,010,1 1 0 0 0 0 1 1 1 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.244.15.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="anomalous" value="1.799070,1.704200,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="149.137.241.106" dst_ip="17.149.132.146" src_port="53" dst_port="47423"/>
            <filter src_ip="149.137.241.106" dst_ip="17.149.132.146" src_port="53" dst_port="24752"/>
            <filter src_ip="149.137.241.106" dst_ip="17.149.132.36" src_port="53" dst_port="11771"/>
            <filter src_ip="149.137.241.106" dst_ip="17.149.133.154" src_port="59293" dst_port="25"/>
        </slice>
        <from usec="0" sec="1275800878"/>
        <to usec="0" sec="1275800881"/>
    </anomaly>
    <anomaly type="anomalous" value="2.260640,1.713750,503,1 0 0 1 1 1 1 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="192.219.181.19" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.682740,1.467220,503,1 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="176.150.174.178" dst_ip="187.58.76.95" src_port="49405" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="24.235.99.108" dst_ip="176.150.139.68" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.951850,2.964040,010,1 1 1 1 1 1 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="212.181.55.243" src_port="6000" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.969290,1.638740,503,0 0 0 1 1 1 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="176.150.16.184" dst_ip="20.194.236.208" src_port="80" dst_port="57822"/>
            <filter src_ip="176.150.16.184" dst_ip="20.194.236.208" src_port="80" dst_port="57821"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,501,0 0 0 1 1 1 0 0 0 1 1 1,salphfl">
        <slice>
            <filter src_ip="193.85.64.23" dst_ip="145.229.17.139" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.879010,1.683480,010,1 1 0 1 1 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.216.112.48" dst_port="23"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275800940"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.241.151.65" dst_ip="32.13.50.113"/>
            <filter src_ip="145.241.151.65" src_port="80"/>
            <filter src_ip="145.241.151.157" dst_ip="32.13.50.113" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="145.225.98.93" dst_ip="24.201.120.232" src_port="80"/>
            <filter src_ip="138.58.135.78" dst_ip="24.201.120.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.711550,1.579150,999,0 0 0 1 1 1 0 0 0 1 0 0,mptpla">
        <slice>
            <filter src_ip="202.121.51.201" dst_ip="192.219.176.157"/>
            <filter dst_ip="192.219.176.157" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.980360,1.663720,503,0 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="192.219.176.29" dst_port="80"/>
            <filter dst_ip="192.219.189.42" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.055140,1.716760,502,1 1 0 1 1 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="164.179.189.144" dst_port="22"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275800879"/>
    </anomaly>
    <anomaly type="anomalous" value="2.377400,1.747500,999,1 0 0 1 1 1 1 1 1 1 1 0,ipv46tun">
        <slice>
            <filter src_ip="203.32.195.4"/>
            <filter src_ip="203.32.195.6"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.563190,1.418020,999,0 0 0 1 0 0 1 1 1 1 1 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="176.150.35.39" src_port="53"/>
            <filter dst_ip="193.128.117.12" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.556490,2.778440,999,1 1 1 1 1 1 1 1 1 1 0 0,ptmp">
        <slice>
            <filter src_ip="192.219.50.113" src_port="58584"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.538330,1.463990,999,1 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="193.100.255.221" src_port="53"/>
            <filter dst_ip="192.219.188.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="145.225.16.29" dst_ip="216.1.2.188"/>
            <filter src_ip="145.225.16.29" dst_ip="24.201.120.67" src_port="80"/>
            <filter src_ip="176.150.86.5" dst_ip="216.1.2.188" src_port="80"/>
            <filter src_ip="149.137.203.22" dst_ip="216.1.2.188" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.394590,1.369090,503,0 0 0 1 1 0 1 1 1 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.136.169.1" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.205970,2.621850,503,1 1 1 1 1 0 0 0 0 1 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.219.181.19" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.802050,1.999830,901,1 1 0 1 1 0 1 1 1 1 1 1,empty">
        <slice/>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter dst_ip="176.150.138.55" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.590080,1.957240,503,1 1 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="176.150.139.68" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.877370,1.505290,999,1 0 0 1 0 0 1 1 1 1 1 0,mptmp">
        <slice>
            <filter dst_ip="192.219.180.98"/>
            <filter dst_ip="192.219.180.110"/>
            <filter dst_ip="176.150.16.208"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.428560,1.886660,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="145.225.81.39" dst_ip="24.201.120.241" src_port="80"/>
            <filter src_ip="145.225.81.39" dst_ip="216.1.2.21" src_port="80"/>
            <filter src_ip="145.225.81.39" dst_ip="169.248.142.5" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.941750,1.664830,503,0 0 0 1 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="149.137.95.187" dst_port="80"/>
            <filter src_ip="149.137.95.187"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.769800,1.981860,503,1 0 0 1 1 1 1 1 1 1 1 1,mptmp">
        <slice>
            <filter src_ip="192.219.176.29" src_port="80"/>
            <filter src_ip="192.219.181.33" src_port="80"/>
            <filter src_ip="192.219.181.32" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="3.694000,2.850130,010,1 1 1 0 0 0 1 1 1 1 1 1,ntscSYNt">
        <slice>
            <filter src_ip="37.161.180.40" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.981510,1.702130,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="149.137.134.152" dst_ip="44.181.210.79" src_port="49174" dst_port="80"/>
            <filter src_ip="193.136.173.207" dst_ip="44.181.210.79" src_port="60321" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174520,1.449240,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.150.16.177"/>
        </slice>
        <from usec="0" sec="1275801218"/>
        <to usec="0" sec="1275801220"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174520,1.449240,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="42.191.40.235"/>
        </slice>
        <from usec="0" sec="1275801131"/>
        <to usec="0" sec="1275801134"/>
    </anomaly>
    <anomaly type="suspicious" value="1.174520,1.449240,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="176.150.138.209"/>
        </slice>
        <from usec="0" sec="1275800933"/>
        <to usec="0" sec="1275800935"/>
    </anomaly>
    <anomaly type="suspicious" value="1.293650,1.424820,503,1 0 0 1 1 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.137.0.136" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801228"/>
    </anomaly>
    <anomaly type="suspicious" value="1.106120,1.405240,503,1 0 0 1 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.150.138.158" dst_ip="79.167.140.8" src_port="3379" dst_port="3076"/>
            <filter src_ip="176.150.138.158" dst_ip="35.22.229.51" src_port="3119" dst_port="3076"/>
            <filter src_ip="176.150.138.158" dst_ip="187.58.77.114" src_port="1154" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275800958"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506660,1.583490,501,0 0 0 1 1 1 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="37.88.218.128" dst_ip="145.229.4.10" src_port="21"/>
        </slice>
        <from usec="0" sec="1275800964"/>
        <to usec="0" sec="1275800972"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506660,1.583490,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.225.197.10" dst_ip="24.201.127.93" src_port="80"/>
        </slice>
        <from usec="0" sec="1275800426"/>
        <to usec="0" sec="1275800853"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506660,1.583490,999,0 0 0 1 1 1 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="145.241.151.218" dst_ip="216.1.37.141" src_port="995" dst_port="63815"/>
        </slice>
        <from usec="0" sec="1275800533"/>
        <to usec="0" sec="1275800541"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118910,1.327120,504,0 0 0 1 1 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="145.225.46.124" dst_ip="24.201.120.217" src_port="80"/>
            <filter src_ip="145.225.46.124" dst_ip="24.201.120.195" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.506660,1.583490,010,0 0 0 1 1 1 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="194.180.28.56" dst_port="5900"/>
        </slice>
        <from usec="0" sec="1275800401"/>
        <to usec="0" sec="1275801136"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.105.194" src_port="6267"/>
        </slice>
        <from usec="0" sec="1275800678"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,020,0 0 0 0 0 0 1 1 1 0 0 0,ttl_error">
        <slice>
            <filter src_ip="145.6.66.22"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.6.67.73" src_port="53"/>
            <filter src_ip="145.6.67.73" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter src_ip="149.137.227.97" dst_ip="217.4.21.116"/>
            <filter src_ip="149.137.227.97" dst_ip="217.4.22.79"/>
            <filter src_ip="149.137.227.97" dst_port="2703"/>
            <filter dst_ip="217.4.21.116" dst_port="2703"/>
            <filter dst_ip="217.4.22.79" dst_port="2703"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801129"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="73.36.227.143" src_port="80"/>
            <filter src_ip="73.36.227.143" src_port="33890"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.241.16.145" src_port="25"/>
            <filter src_ip="145.241.16.145" src_port="32772" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="213.20.202.222"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.241.151.217" src_port="25"/>
            <filter src_ip="145.241.151.217" dst_port="25"/>
        </slice>
        <from usec="0" sec="1275800428"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="195.64.214.97"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="193.129.199.168" dst_port="445"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="1.133790,1.374100,999,0 0 0 1 1 0 1 1 1 0 0 0,mptmp">
        <slice>
            <filter dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801220"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.219.188.1" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="73.55.67.176" dst_port="445"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="35.22.251.247" src_port="10008"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.0.182.60" src_port="8080"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="32.76.94.40" src_port="80"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,503,0 0 0 1 0 0 1 1 1 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="193.128.104.248" dst_ip="150.234.173.73" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275800957"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.241.151.222" src_port="53"/>
            <filter src_ip="149.137.221.140" src_port="53"/>
        </slice>
        <from usec="0" sec="1275800422"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.45.84.62" src_port="80"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="212.192.178.222" src_port="64482" dst_port="25"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="59.33.150.160" src_port="80"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.64.16.104" src_port="2294" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="73.61.132.81" src_port="2871" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="34.26.118.176" src_port="3411" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="25.84.243.166" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="25.84.243.166" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275800716"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,020,0 0 0 1 0 0 1 1 1 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="26.143.215.161" dst_port="53"/>
            <filter src_ip="145.6.66.20"/>
        </slice>
        <from usec="0" sec="1275800401"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.134.110.51" src_port="6667"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="73.36.227.143" src_port="33890"/>
            <filter src_ip="73.36.227.143" src_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,503,0 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.128.117.12" dst_port="80"/>
            <filter src_ip="193.128.117.12" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="208.96.26.5" dst_ip="145.241.95.176"/>
            <filter src_ip="208.96.26.5" dst_ip="145.241.95.85"/>
            <filter src_ip="208.96.26.5" dst_ip="145.241.95.212"/>
            <filter src_ip="208.96.26.5" dst_port="80"/>
            <filter dst_ip="145.241.95.176" dst_port="80"/>
            <filter dst_ip="145.241.95.85" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="213.20.202.222"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="145.241.151.217" src_port="25"/>
            <filter src_ip="145.241.151.217" dst_port="25"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="195.64.214.97"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.137.105.3" src_port="5613"/>
        </slice>
        <from usec="0" sec="1275800401"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscACK">
        <slice>
            <filter src_ip="149.137.71.244" src_port="4669"/>
            <filter src_ip="193.128.74.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,999,0 0 0 1 0 0 1 1 1 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="178.128.187.227" dst_port="36141"/>
        </slice>
        <from usec="0" sec="1275800400"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.221.140" src_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.221.140" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="56.152.149.226" src_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="56.152.144.251" src_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="149.137.190.35" dst_ip="20.218.194.80" dst_port="80"/>
            <filter src_ip="149.137.190.35" dst_ip="217.27.234.116" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="193.129.199.168" dst_port="445"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,502,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="164.179.189.144" dst_port="22"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.221.129" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.4.96" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.137.34.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.219.180.110" src_port="17660"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.219.187.9" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,010,0 0 0 1 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="192.219.187.9" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275800508"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.241.151.162" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.241.151.161" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="193.128.74.236" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.150.35.39" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="35.22.251.247" src_port="10008"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="213.0.182.60" src_port="8080"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,503,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.128.104.248" dst_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.241.151.222" src_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.241.151.222" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.914031,1.353790,503,0 0 0 1 0 0 1 1 1 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="132.133.15.204" dst_ip="43.212.102.64" src_port="80"/>
            <filter src_ip="132.133.15.204" dst_ip="218.18.100.199" src_port="80"/>
        </slice>
        <from usec="0" sec="1275800401"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="149.137.73.16" src_port="1438"/>
        </slice>
        <from usec="0" sec="1275800670"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="192.219.186.75" dst_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="193.45.84.62" src_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="212.192.178.222" src_port="64482" dst_port="25"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="59.33.150.160" src_port="80"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="31.218.83.94" src_port="53"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="217.69.11.121" src_port="6008" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmp">
        <slice>
            <filter src_ip="217.69.11.121" src_port="6008" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.64.16.104" src_port="2294" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="73.61.132.81" src_port="2871" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="34.26.118.176" src_port="3411" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,999,0 0 0 0 0 0 1 1 1 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="72.79.143.51" src_port="1035" dst_port="1434"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="25.84.243.166" src_port="80" dst_port="1024"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.995715,1.399410,010,0 0 0 0 0 0 1 1 1 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="25.84.243.166" src_port="80" dst_port="3072"/>
        </slice>
        <from usec="0" sec="1275801255"/>
        <to usec="0" sec="1275801301"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="41.80.44.44"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="34.156.71.165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,999,0 0 0 1 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="149.137.164.24" dst_ip="45.56.215.15" src_port="524" dst_port="1513"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="145.225.157.51"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.118910,1.327120,999,0 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="203.202.222.244" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,999,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="149.137.190.35" src_port="53"/>
            <filter dst_ip="149.137.190.35" src_port="25"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="209.75.226.8" dst_ip="149.137.105.196" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,999,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="176.150.138.212" dst_port="9803"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,999,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="176.150.138.49" src_port="5041" dst_port="5041"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.380810,1.422400,503,0 0 0 0 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="193.136.169.1" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,503,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="145.241.150.71" dst_port="80"/>
            <filter dst_ip="193.129.211.139" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.978737,1.353310,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.150.38.83" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,503,0 0 0 1 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.225.130.107" dst_ip="24.201.120.220" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.380810,1.422400,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="145.225.0.60" dst_ip="24.201.127.33" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,999,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="176.150.148.157"/>
            <filter dst_ip="18.164.108.238" dst_port="995"/>
            <filter dst_ip="18.164.108.238" dst_port="993"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.323120,1.377540,503,0 0 0 1 0 0 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.150.138.246" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.380810,1.422400,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="138.58.199.14" dst_ip="24.201.127.123" src_port="80"/>
            <filter src_ip="145.225.161.47" dst_ip="24.201.127.123" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
